16.1 Common ACE Exam Scenarios & Decision Frameworks

Why This Matters on the ACE Exam

Google's own exam guide describes the Associate Cloud Engineer (ACE) exam as measuring the ability to "deploy applications, monitor operations, and manage enterprise solutions," and in practice that translates into a heavily scenario-based question style: a two-to-four sentence business situation, followed by four options that all sound plausible. Unlike a pure recall exam, ACE rarely asks "what does Cloud Run do?" in isolation — it asks "a team needs X, Y, and Z; which service or configuration satisfies all three constraints at once?" Chapters 2 through 15 built the raw material: every named service, Identity and Access Management (IAM) role, and networking primitive on the official exam guide. This closing chapter's job is different — it trains the decision-making pattern you actually use under exam pressure by collecting the recurring cross-domain decision frameworks into one place and walking through full scenarios the way you will see them on test day.

The Five Recurring Decision Frameworks

Nearly every ACE scenario question reduces to one of five decisions. Recognizing which one you are facing — often from a single trigger phrase in the stem — is the fastest way to eliminate two of the four options before you have even finished reading the choices.

1. Compute choice (Chapter 4.1; Chapters 6-8)

2. Data storage choice (Chapter 4.3; Chapter 9.1)

3. Connectivity choice (Chapter 5; Chapter 10)

4. IAM choice (Chapter 14; Chapter 15)

5. Operations and monitoring choice (Chapter 13)

Eliminating Distractors: Common Trap Patterns

The wrong answers on ACE questions are rarely random — they follow patterns worth recognizing on sight:

• The deprecated/legacy answer. Cloud Deployment Manager appears in older third-party material but is not one of the four infrastructure-as-code (IaC) tools the current exam guide names (Terraform, Cloud Foundation Toolkit, Config Connector, Helm — Chapter 10.3); if it shows up as an option next to one of those four, it is almost always the distractor.
• The over-privileged answer. Any option using a Basic role (Owner/Editor/Viewer) or a long-lived, downloaded service account key on a question that mentions "least privilege," "minimize blast radius," or "avoid standing credentials" is a trap — the correct answer is a predefined/custom role or impersonation (Chapter 14; Chapter 15.3).
• The wrong-scope answer. IAM policy and Organization Policy are frequently confused: IAM governs who can do what; Org Policy governs what configurations are allowed at all, regardless of who is asking (for example, "disallow public IPs on VMs" is an Org Policy constraint, not an IAM role assignment).
• The wrong-durability answer. Snapshot vs. image, and zonal vs. regional Persistent Disk, are a recurring pair: a snapshot backs up a disk's data (incremental, used for recovery); an image boots a new VM (used for templating a fleet). A zonal Persistent Disk exists in one zone only; a regional Persistent Disk synchronously replicates across two zones in the same region for higher availability.
• The wrong-billing-model answer. BigQuery's on-demand pricing charges for bytes scanned, not compute-hours — a scenario emphasizing "cost of ad hoc analytics queries" should not point you toward a compute-hour-billed service like Compute Engine or GKE.

Full Walk-Through Scenario

A company runs a Cloud Run service that needs to read from a Cloud Storage bucket and write rows to BigQuery. The security team requires that no long-lived credentials ever leave Google's infrastructure, and that the service can only touch the one bucket and one dataset it needs. Applying the frameworks above, this is an IAM-choice question wearing a compute-and-storage costume. The correct approach is: (1) create a dedicated service account for the Cloud Run service — never the human developer's own identity; (2) attach that service account directly to the Cloud Run revision; and (3) grant it a predefined or custom role scoped to only that bucket and that dataset, not Storage Admin or BigQuery Admin at the project level, and never a downloaded JSON key. Cloud Run's attached service account already supplies short-lived, automatically-rotated credentials, satisfying the "no long-lived credentials" requirement without any extra impersonation step.

A second, networking-flavored variant: A retailer's platform team owns one VPC and wants 15 application teams, each in a separate project for billing isolation, to deploy workloads that share consistent firewall policy and can reach each other over private IPs — with the platform team retaining sole control of subnet creation. This is the connectivity framework: the trigger phrase "one team retains control, many projects attach" points to Shared VPC with the platform team's project as host, not VPC Network Peering (which would require 15 separate networks to individually peer, with no central control) and not 15 independent VPCs joined by Cloud VPN (which solves external connectivity, not intra-organization sharing).

Key Takeaways

• Nearly every ACE scenario question maps to one of five recurring decisions — compute, data storage, connectivity, IAM, or operations/monitoring — so learn the trigger phrase, not just the service name.
• Distractors follow patterns: deprecated tools, over-privileged IAM options, IAM/Org Policy scope confusion, snapshot/image and zonal/regional Persistent Disk mix-ups, and mismatched billing models.
• A "least privilege" or "no long-lived credentials" cue in the stem should immediately point you toward service accounts, predefined/custom roles, and impersonation, not Basic roles or downloaded keys.
• Multi-domain scenarios — a question that looks like compute but is really about IAM, or looks like networking but is really about centralized control — are common on ACE; read the full stem before committing to a framework.
• Drilling the trigger-phrase tables until recall is automatic saves real time on exam day, where average pace is roughly two minutes per question.